/src/openssl/crypto/ts/ts_conf.c

Source (jump to first uncovered line)
/*
 * Copyright 2006-2020 The OpenSSL Project Authors. All Rights Reserved.
 *
 * Licensed under the Apache License 2.0 (the "License").  You may not use
 * this file except in compliance with the License.  You can obtain a copy
 * in the file LICENSE in the source distribution or at
 * https://www.openssl.org/source/license.html
 */

/* We need to use some engine deprecated APIs */
#define OPENSSL_SUPPRESS_DEPRECATED

#include <string.h>

#include <openssl/crypto.h>
#include "internal/cryptlib.h"
#include <openssl/pem.h>
#include <openssl/engine.h>
#include <openssl/ts.h>
#include <openssl/conf_api.h>

/* Macro definitions for the configuration file. */
#define BASE_SECTION                    "tsa"
#define ENV_DEFAULT_TSA                 "default_tsa"
#define ENV_SERIAL                      "serial"
#define ENV_CRYPTO_DEVICE               "crypto_device"
#define ENV_SIGNER_CERT                 "signer_cert"
#define ENV_CERTS                       "certs"
#define ENV_SIGNER_KEY                  "signer_key"
#define ENV_SIGNER_DIGEST               "signer_digest"
#define ENV_DEFAULT_POLICY              "default_policy"
#define ENV_OTHER_POLICIES              "other_policies"
#define ENV_DIGESTS                     "digests"
#define ENV_ACCURACY                    "accuracy"
#define ENV_ORDERING                    "ordering"
#define ENV_TSA_NAME                    "tsa_name"
#define ENV_ESS_CERT_ID_CHAIN           "ess_cert_id_chain"
#define ENV_VALUE_SECS                  "secs"
#define ENV_VALUE_MILLISECS             "millisecs"
#define ENV_VALUE_MICROSECS             "microsecs"
#define ENV_CLOCK_PRECISION_DIGITS      "clock_precision_digits"
#define ENV_VALUE_YES                   "yes"
#define ENV_VALUE_NO                    "no"
#define ENV_ESS_CERT_ID_ALG             "ess_cert_id_alg"

/* Function definitions for certificate and key loading. */

X509 *TS_CONF_load_cert(const char *file)
{
    BIO *cert = NULL;
    X509 *x = NULL;

    if ((cert = BIO_new_file(file, "r")) == NULL)
        goto end;
    x = PEM_read_bio_X509_AUX(cert, NULL, NULL, NULL);
 end:
    if (x == NULL)
        ERR_raise(ERR_LIB_TS, TS_R_CANNOT_LOAD_CERT);
    BIO_free(cert);
    return x;
}

STACK_OF(X509) *TS_CONF_load_certs(const char *file)
{
    BIO *certs = NULL;
    STACK_OF(X509) *othercerts = NULL;
    STACK_OF(X509_INFO) *allcerts = NULL;
    int i;

    if ((certs = BIO_new_file(file, "r")) == NULL)
        goto end;
    if ((othercerts = sk_X509_new_null()) == NULL)
        goto end;

    allcerts = PEM_X509_INFO_read_bio(certs, NULL, NULL, NULL);
    for (i = 0; i < sk_X509_INFO_num(allcerts); i++) {
        X509_INFO *xi = sk_X509_INFO_value(allcerts, i);

        if (xi->x509 != NULL) {
            if (!X509_add_cert(othercerts, xi->x509, X509_ADD_FLAG_DEFAULT)) {
                sk_X509_pop_free(othercerts, X509_free);
                othercerts = NULL;
                goto end;
            }
            xi->x509 = NULL;
        }
    }
 end:
    if (othercerts == NULL)
        ERR_raise(ERR_LIB_TS, TS_R_CANNOT_LOAD_CERT);
    sk_X509_INFO_pop_free(allcerts, X509_INFO_free);
    BIO_free(certs);
    return othercerts;
}

EVP_PKEY *TS_CONF_load_key(const char *file, const char *pass)
{
    BIO *key = NULL;
    EVP_PKEY *pkey = NULL;

    if ((key = BIO_new_file(file, "r")) == NULL)
        goto end;
    pkey = PEM_read_bio_PrivateKey(key, NULL, NULL, (char *)pass);
 end:
    if (pkey == NULL)
        ERR_raise(ERR_LIB_TS, TS_R_CANNOT_LOAD_KEY);
    BIO_free(key);
    return pkey;
}

/* Function definitions for handling configuration options. */

static void ts_CONF_lookup_fail(const char *name, const char *tag)
{
    ERR_raise_data(ERR_LIB_TS, TS_R_VAR_LOOKUP_FAILURE, "%s::%s", name, tag);
}

static void ts_CONF_invalid(const char *name, const char *tag)
{
    ERR_raise_data(ERR_LIB_TS, TS_R_VAR_BAD_VALUE, "%s::%s", name, tag);
}

const char *TS_CONF_get_tsa_section(CONF *conf, const char *section)
{
    if (!section) {
        section = NCONF_get_string(conf, BASE_SECTION, ENV_DEFAULT_TSA);
        if (!section)
            ts_CONF_lookup_fail(BASE_SECTION, ENV_DEFAULT_TSA);
    }
    return section;
}

int TS_CONF_set_serial(CONF *conf, const char *section, TS_serial_cb cb,
                       TS_RESP_CTX *ctx)
{
    int ret = 0;
    char *serial = NCONF_get_string(conf, section, ENV_SERIAL);
    if (!serial) {
        ts_CONF_lookup_fail(section, ENV_SERIAL);
        goto err;
    }
    TS_RESP_CTX_set_serial_cb(ctx, cb, serial);

    ret = 1;
 err:
    return ret;
}

#ifndef OPENSSL_NO_ENGINE

int TS_CONF_set_crypto_device(CONF *conf, const char *section,
                              const char *device)
{
    int ret = 0;

    if (device == NULL)
        device = NCONF_get_string(conf, section, ENV_CRYPTO_DEVICE);

    if (device && !TS_CONF_set_default_engine(device)) {
        ts_CONF_invalid(section, ENV_CRYPTO_DEVICE);
        goto err;
    }
    ret = 1;
 err:
    return ret;
}

int TS_CONF_set_default_engine(const char *name)
{
    ENGINE *e = NULL;
    int ret = 0;

    if (strcmp(name, "builtin") == 0)
        return 1;

    if ((e = ENGINE_by_id(name)) == NULL)
        goto err;
    if (strcmp(name, "chil") == 0)
        ENGINE_ctrl(e, ENGINE_CTRL_CHIL_SET_FORKCHECK, 1, 0, 0);
    if (!ENGINE_set_default(e, ENGINE_METHOD_ALL))
        goto err;
    ret = 1;

 err:
    if (!ret)
        ERR_raise_data(ERR_LIB_TS, TS_R_COULD_NOT_SET_ENGINE,
                       "engine:%s", name);
    ENGINE_free(e);
    return ret;
}

#endif

int TS_CONF_set_signer_cert(CONF *conf, const char *section,
                            const char *cert, TS_RESP_CTX *ctx)
{
    int ret = 0;
    X509 *cert_obj = NULL;

    if (cert == NULL) {
        cert = NCONF_get_string(conf, section, ENV_SIGNER_CERT);
        if (cert == NULL) {
            ts_CONF_lookup_fail(section, ENV_SIGNER_CERT);
            goto err;
        }
    }
    if ((cert_obj = TS_CONF_load_cert(cert)) == NULL)
        goto err;
    if (!TS_RESP_CTX_set_signer_cert(ctx, cert_obj))
        goto err;

    ret = 1;
 err:
    X509_free(cert_obj);
    return ret;
}

int TS_CONF_set_certs(CONF *conf, const char *section, const char *certs,
                      TS_RESP_CTX *ctx)
{
    int ret = 0;
    STACK_OF(X509) *certs_obj = NULL;

    if (certs == NULL) {
        /* Certificate chain is optional. */
        if ((certs = NCONF_get_string(conf, section, ENV_CERTS)) == NULL)
            goto end;
    }
    if ((certs_obj = TS_CONF_load_certs(certs)) == NULL)
        goto err;
    if (!TS_RESP_CTX_set_certs(ctx, certs_obj))
        goto err;
 end:
    ret = 1;
 err:
    sk_X509_pop_free(certs_obj, X509_free);
    return ret;
}

int TS_CONF_set_signer_key(CONF *conf, const char *section,
                           const char *key, const char *pass,
                           TS_RESP_CTX *ctx)
{
    int ret = 0;
    EVP_PKEY *key_obj = NULL;
    if (!key)
        key = NCONF_get_string(conf, section, ENV_SIGNER_KEY);
    if (!key) {
        ts_CONF_lookup_fail(section, ENV_SIGNER_KEY);
        goto err;
    }
    if ((key_obj = TS_CONF_load_key(key, pass)) == NULL)
        goto err;
    if (!TS_RESP_CTX_set_signer_key(ctx, key_obj))
        goto err;

    ret = 1;
 err:
    EVP_PKEY_free(key_obj);
    return ret;
}

int TS_CONF_set_signer_digest(CONF *conf, const char *section,
                              const char *md, TS_RESP_CTX *ctx)
{
    int ret = 0;
    const EVP_MD *sign_md = NULL;
    if (md == NULL)
        md = NCONF_get_string(conf, section, ENV_SIGNER_DIGEST);
    if (md == NULL) {
        ts_CONF_lookup_fail(section, ENV_SIGNER_DIGEST);
        goto err;
    }
    sign_md = EVP_get_digestbyname(md);
    if (sign_md == NULL) {
        ts_CONF_invalid(section, ENV_SIGNER_DIGEST);
        goto err;
    }
    if (!TS_RESP_CTX_set_signer_digest(ctx, sign_md))
        goto err;

    ret = 1;
 err:
    return ret;
}

int TS_CONF_set_def_policy(CONF *conf, const char *section,
                           const char *policy, TS_RESP_CTX *ctx)
{
    int ret = 0;
    ASN1_OBJECT *policy_obj = NULL;

    if (policy == NULL)
        policy = NCONF_get_string(conf, section, ENV_DEFAULT_POLICY);
    if (policy == NULL) {
        ts_CONF_lookup_fail(section, ENV_DEFAULT_POLICY);
        goto err;
    }
    if ((policy_obj = OBJ_txt2obj(policy, 0)) == NULL) {
        ts_CONF_invalid(section, ENV_DEFAULT_POLICY);
        goto err;
    }
    if (!TS_RESP_CTX_set_def_policy(ctx, policy_obj))
        goto err;

    ret = 1;
 err:
    ASN1_OBJECT_free(policy_obj);
    return ret;
}

int TS_CONF_set_policies(CONF *conf, const char *section, TS_RESP_CTX *ctx)
{
    int ret = 0;
    int i;
    STACK_OF(CONF_VALUE) *list = NULL;
    char *policies = NCONF_get_string(conf, section, ENV_OTHER_POLICIES);

    /* If no other policy is specified, that's fine. */
    if (policies && (list = X509V3_parse_list(policies)) == NULL) {
        ts_CONF_invalid(section, ENV_OTHER_POLICIES);
        goto err;
    }
    for (i = 0; i < sk_CONF_VALUE_num(list); ++i) {
        CONF_VALUE *val = sk_CONF_VALUE_value(list, i);
        const char *extval = val->value ? val->value : val->name;
        ASN1_OBJECT *objtmp;

        if ((objtmp = OBJ_txt2obj(extval, 0)) == NULL) {
            ts_CONF_invalid(section, ENV_OTHER_POLICIES);
            goto err;
        }
        if (!TS_RESP_CTX_add_policy(ctx, objtmp))
            goto err;
        ASN1_OBJECT_free(objtmp);
    }

    ret = 1;
 err:
    sk_CONF_VALUE_pop_free(list, X509V3_conf_free);
    return ret;
}

int TS_CONF_set_digests(CONF *conf, const char *section, TS_RESP_CTX *ctx)
{
    int ret = 0;
    int i;
    STACK_OF(CONF_VALUE) *list = NULL;
    char *digests = NCONF_get_string(conf, section, ENV_DIGESTS);

    if (digests == NULL) {
        ts_CONF_lookup_fail(section, ENV_DIGESTS);
        goto err;
    }
    if ((list = X509V3_parse_list(digests)) == NULL) {
        ts_CONF_invalid(section, ENV_DIGESTS);
        goto err;
    }
    if (sk_CONF_VALUE_num(list) == 0) {
        ts_CONF_invalid(section, ENV_DIGESTS);
        goto err;
    }
    for (i = 0; i < sk_CONF_VALUE_num(list); ++i) {
        CONF_VALUE *val = sk_CONF_VALUE_value(list, i);
        const char *extval = val->value ? val->value : val->name;
        const EVP_MD *md;

        if ((md = EVP_get_digestbyname(extval)) == NULL) {
            ts_CONF_invalid(section, ENV_DIGESTS);
            goto err;
        }
        if (!TS_RESP_CTX_add_md(ctx, md))
            goto err;
    }

    ret = 1;
 err:
    sk_CONF_VALUE_pop_free(list, X509V3_conf_free);
    return ret;
}

int TS_CONF_set_accuracy(CONF *conf, const char *section, TS_RESP_CTX *ctx)
{
    int ret = 0;
    int i;
    int secs = 0, millis = 0, micros = 0;
    STACK_OF(CONF_VALUE) *list = NULL;
    char *accuracy = NCONF_get_string(conf, section, ENV_ACCURACY);

    if (accuracy && (list = X509V3_parse_list(accuracy)) == NULL) {
        ts_CONF_invalid(section, ENV_ACCURACY);
        goto err;
    }
    for (i = 0; i < sk_CONF_VALUE_num(list); ++i) {
        CONF_VALUE *val = sk_CONF_VALUE_value(list, i);
        if (strcmp(val->name, ENV_VALUE_SECS) == 0) {
            if (val->value)
                secs = atoi(val->value);
        } else if (strcmp(val->name, ENV_VALUE_MILLISECS) == 0) {
            if (val->value)
                millis = atoi(val->value);
        } else if (strcmp(val->name, ENV_VALUE_MICROSECS) == 0) {
            if (val->value)
                micros = atoi(val->value);
        } else {
            ts_CONF_invalid(section, ENV_ACCURACY);
            goto err;
        }
    }
    if (!TS_RESP_CTX_set_accuracy(ctx, secs, millis, micros))
        goto err;

    ret = 1;
 err:
    sk_CONF_VALUE_pop_free(list, X509V3_conf_free);
    return ret;
}

int TS_CONF_set_clock_precision_digits(const CONF *conf, const char *section,
                                       TS_RESP_CTX *ctx)
{
    int ret = 0;
    long digits = 0;

    /*
     * If not specified, set the default value to 0, i.e. sec precision
     */
    digits = _CONF_get_number(conf, section, ENV_CLOCK_PRECISION_DIGITS);
    if (digits < 0 || digits > TS_MAX_CLOCK_PRECISION_DIGITS) {
        ts_CONF_invalid(section, ENV_CLOCK_PRECISION_DIGITS);
        goto err;
    }

    if (!TS_RESP_CTX_set_clock_precision_digits(ctx, digits))
        goto err;

    return 1;
 err:
    return ret;
}

static int ts_CONF_add_flag(CONF *conf, const char *section,
                            const char *field, int flag, TS_RESP_CTX *ctx)
{
    const char *value = NCONF_get_string(conf, section, field);

    if (value) {
        if (strcmp(value, ENV_VALUE_YES) == 0)
            TS_RESP_CTX_add_flags(ctx, flag);
        else if (strcmp(value, ENV_VALUE_NO) != 0) {
            ts_CONF_invalid(section, field);
            return 0;
        }
    }

    return 1;
}

int TS_CONF_set_ordering(CONF *conf, const char *section, TS_RESP_CTX *ctx)
{
    return ts_CONF_add_flag(conf, section, ENV_ORDERING, TS_ORDERING, ctx);
}

int TS_CONF_set_tsa_name(CONF *conf, const char *section, TS_RESP_CTX *ctx)
{
    return ts_CONF_add_flag(conf, section, ENV_TSA_NAME, TS_TSA_NAME, ctx);
}

int TS_CONF_set_ess_cert_id_chain(CONF *conf, const char *section,
                                  TS_RESP_CTX *ctx)
{
    return ts_CONF_add_flag(conf, section, ENV_ESS_CERT_ID_CHAIN,
                            TS_ESS_CERT_ID_CHAIN, ctx);
}

int TS_CONF_set_ess_cert_id_digest(CONF *conf, const char *section,
                                   TS_RESP_CTX *ctx)
{
    int ret = 0;
    const EVP_MD *cert_md = NULL;
    const char *md = NCONF_get_string(conf, section, ENV_ESS_CERT_ID_ALG);

    if (md == NULL)
        md = "sha1";

    cert_md = EVP_get_digestbyname(md);
    if (cert_md == NULL) {
        ts_CONF_invalid(section, ENV_ESS_CERT_ID_ALG);
        goto err;
    }

    if (!TS_RESP_CTX_set_ess_cert_id_digest(ctx, cert_md))
        goto err;

    ret = 1;
err:
    return ret;
}

Coverage Report

Created: 2025-04-22 06:18

Line	Count	Source (jump to first uncovered line)
1		/*
2		* Copyright 2006-2020 The OpenSSL Project Authors. All Rights Reserved.
3		*
4		* Licensed under the Apache License 2.0 (the "License"). You may not use
5		* this file except in compliance with the License. You can obtain a copy
6		* in the file LICENSE in the source distribution or at
7		* https://www.openssl.org/source/license.html
8		*/
9
10		/* We need to use some engine deprecated APIs */
11		#define OPENSSL_SUPPRESS_DEPRECATED
12
13		#include <string.h>
14
15		#include <openssl/crypto.h>
16		#include "internal/cryptlib.h"
17		#include <openssl/pem.h>
18		#include <openssl/engine.h>
19		#include <openssl/ts.h>
20		#include <openssl/conf_api.h>
21
22		/* Macro definitions for the configuration file. */
23	0	#define BASE_SECTION "tsa"
24	0	#define ENV_DEFAULT_TSA "default_tsa"
25	0	#define ENV_SERIAL "serial"
26	0	#define ENV_CRYPTO_DEVICE "crypto_device"
27	0	#define ENV_SIGNER_CERT "signer_cert"
28	0	#define ENV_CERTS "certs"
29	0	#define ENV_SIGNER_KEY "signer_key"
30	0	#define ENV_SIGNER_DIGEST "signer_digest"
31	0	#define ENV_DEFAULT_POLICY "default_policy"
32	0	#define ENV_OTHER_POLICIES "other_policies"
33	0	#define ENV_DIGESTS "digests"
34	0	#define ENV_ACCURACY "accuracy"
35	0	#define ENV_ORDERING "ordering"
36	0	#define ENV_TSA_NAME "tsa_name"
37	0	#define ENV_ESS_CERT_ID_CHAIN "ess_cert_id_chain"
38	0	#define ENV_VALUE_SECS "secs"
39	0	#define ENV_VALUE_MILLISECS "millisecs"
40	0	#define ENV_VALUE_MICROSECS "microsecs"
41	0	#define ENV_CLOCK_PRECISION_DIGITS "clock_precision_digits"
42	0	#define ENV_VALUE_YES "yes"
43	0	#define ENV_VALUE_NO "no"
44	0	#define ENV_ESS_CERT_ID_ALG "ess_cert_id_alg"
45
46		/* Function definitions for certificate and key loading. */
47
48		X509 TS_CONF_load_cert(const char file)
49	0	{
50	0	BIO *cert = NULL;
51	0	X509 *x = NULL;
52
53	0	if ((cert = BIO_new_file(file, "r")) == NULL)
54	0	goto end;
55	0	x = PEM_read_bio_X509_AUX(cert, NULL, NULL, NULL);
56	0	end:
57	0	if (x == NULL)
58	0	ERR_raise(ERR_LIB_TS, TS_R_CANNOT_LOAD_CERT);
59	0	BIO_free(cert);
60	0	return x;
61	0	}
62
63		STACK_OF(X509) TS_CONF_load_certs(const char file)
64	0	{
65	0	BIO *certs = NULL;
66	0	STACK_OF(X509) *othercerts = NULL;
67	0	STACK_OF(X509_INFO) *allcerts = NULL;
68	0	int i;
69
70	0	if ((certs = BIO_new_file(file, "r")) == NULL)
71	0	goto end;
72	0	if ((othercerts = sk_X509_new_null()) == NULL)
73	0	goto end;
74
75	0	allcerts = PEM_X509_INFO_read_bio(certs, NULL, NULL, NULL);
76	0	for (i = 0; i < sk_X509_INFO_num(allcerts); i++) {
77	0	X509_INFO *xi = sk_X509_INFO_value(allcerts, i);
78
79	0	if (xi->x509 != NULL) {
80	0	if (!X509_add_cert(othercerts, xi->x509, X509_ADD_FLAG_DEFAULT)) {
81	0	sk_X509_pop_free(othercerts, X509_free);
82	0	othercerts = NULL;
83	0	goto end;
84	0	}
85	0	xi->x509 = NULL;
86	0	}
87	0	}
88	0	end:
89	0	if (othercerts == NULL)
90	0	ERR_raise(ERR_LIB_TS, TS_R_CANNOT_LOAD_CERT);
91	0	sk_X509_INFO_pop_free(allcerts, X509_INFO_free);
92	0	BIO_free(certs);
93	0	return othercerts;
94	0	}
95
96		EVP_PKEY TS_CONF_load_key(const char file, const char *pass)
97	0	{
98	0	BIO *key = NULL;
99	0	EVP_PKEY *pkey = NULL;
100
101	0	if ((key = BIO_new_file(file, "r")) == NULL)
102	0	goto end;
103	0	pkey = PEM_read_bio_PrivateKey(key, NULL, NULL, (char *)pass);
104	0	end:
105	0	if (pkey == NULL)
106	0	ERR_raise(ERR_LIB_TS, TS_R_CANNOT_LOAD_KEY);
107	0	BIO_free(key);
108	0	return pkey;
109	0	}
110
111		/* Function definitions for handling configuration options. */
112
113		static void ts_CONF_lookup_fail(const char name, const char tag)
114	0	{
115	0	ERR_raise_data(ERR_LIB_TS, TS_R_VAR_LOOKUP_FAILURE, "%s::%s", name, tag);
116	0	}
117
118		static void ts_CONF_invalid(const char name, const char tag)
119	0	{
120	0	ERR_raise_data(ERR_LIB_TS, TS_R_VAR_BAD_VALUE, "%s::%s", name, tag);
121	0	}
122
123		const char TS_CONF_get_tsa_section(CONF conf, const char *section)
124	0	{
125	0	if (!section) {
126	0	section = NCONF_get_string(conf, BASE_SECTION, ENV_DEFAULT_TSA);
127	0	if (!section)
128	0	ts_CONF_lookup_fail(BASE_SECTION, ENV_DEFAULT_TSA);
129	0	}
130	0	return section;
131	0	}
132
133		int TS_CONF_set_serial(CONF conf, const char section, TS_serial_cb cb,
134		TS_RESP_CTX *ctx)
135	0	{
136	0	int ret = 0;
137	0	char *serial = NCONF_get_string(conf, section, ENV_SERIAL);
138	0	if (!serial) {
139	0	ts_CONF_lookup_fail(section, ENV_SERIAL);
140	0	goto err;
141	0	}
142	0	TS_RESP_CTX_set_serial_cb(ctx, cb, serial);
143
144	0	ret = 1;
145	0	err:
146	0	return ret;
147	0	}
148
149		#ifndef OPENSSL_NO_ENGINE
150
151		int TS_CONF_set_crypto_device(CONF conf, const char section,
152		const char *device)
153	0	{
154	0	int ret = 0;
155
156	0	if (device == NULL)
157	0	device = NCONF_get_string(conf, section, ENV_CRYPTO_DEVICE);
158
159	0	if (device && !TS_CONF_set_default_engine(device)) {
160	0	ts_CONF_invalid(section, ENV_CRYPTO_DEVICE);
161	0	goto err;
162	0	}
163	0	ret = 1;
164	0	err:
165	0	return ret;
166	0	}
167
168		int TS_CONF_set_default_engine(const char *name)
169	0	{
170	0	ENGINE *e = NULL;
171	0	int ret = 0;
172
173	0	if (strcmp(name, "builtin") == 0)
174	0	return 1;
175
176	0	if ((e = ENGINE_by_id(name)) == NULL)
177	0	goto err;
178	0	if (strcmp(name, "chil") == 0)
179	0	ENGINE_ctrl(e, ENGINE_CTRL_CHIL_SET_FORKCHECK, 1, 0, 0);
180	0	if (!ENGINE_set_default(e, ENGINE_METHOD_ALL))
181	0	goto err;
182	0	ret = 1;
183
184	0	err:
185	0	if (!ret)
186	0	ERR_raise_data(ERR_LIB_TS, TS_R_COULD_NOT_SET_ENGINE,
187	0	"engine:%s", name);
188	0	ENGINE_free(e);
189	0	return ret;
190	0	}
191
192		#endif
193
194		int TS_CONF_set_signer_cert(CONF conf, const char section,
195		const char cert, TS_RESP_CTX ctx)
196	0	{
197	0	int ret = 0;
198	0	X509 *cert_obj = NULL;
199
200	0	if (cert == NULL) {
201	0	cert = NCONF_get_string(conf, section, ENV_SIGNER_CERT);
202	0	if (cert == NULL) {
203	0	ts_CONF_lookup_fail(section, ENV_SIGNER_CERT);
204	0	goto err;
205	0	}
206	0	}
207	0	if ((cert_obj = TS_CONF_load_cert(cert)) == NULL)
208	0	goto err;
209	0	if (!TS_RESP_CTX_set_signer_cert(ctx, cert_obj))
210	0	goto err;
211
212	0	ret = 1;
213	0	err:
214	0	X509_free(cert_obj);
215	0	return ret;
216	0	}
217
218		int TS_CONF_set_certs(CONF conf, const char section, const char *certs,
219		TS_RESP_CTX *ctx)
220	0	{
221	0	int ret = 0;
222	0	STACK_OF(X509) *certs_obj = NULL;
223
224	0	if (certs == NULL) {
225		/* Certificate chain is optional. */
226	0	if ((certs = NCONF_get_string(conf, section, ENV_CERTS)) == NULL)
227	0	goto end;
228	0	}
229	0	if ((certs_obj = TS_CONF_load_certs(certs)) == NULL)
230	0	goto err;
231	0	if (!TS_RESP_CTX_set_certs(ctx, certs_obj))
232	0	goto err;
233	0	end:
234	0	ret = 1;
235	0	err:
236	0	sk_X509_pop_free(certs_obj, X509_free);
237	0	return ret;
238	0	}
239
240		int TS_CONF_set_signer_key(CONF conf, const char section,
241		const char key, const char pass,
242		TS_RESP_CTX *ctx)
243	0	{
244	0	int ret = 0;
245	0	EVP_PKEY *key_obj = NULL;
246	0	if (!key)
247	0	key = NCONF_get_string(conf, section, ENV_SIGNER_KEY);
248	0	if (!key) {
249	0	ts_CONF_lookup_fail(section, ENV_SIGNER_KEY);
250	0	goto err;
251	0	}
252	0	if ((key_obj = TS_CONF_load_key(key, pass)) == NULL)
253	0	goto err;
254	0	if (!TS_RESP_CTX_set_signer_key(ctx, key_obj))
255	0	goto err;
256
257	0	ret = 1;
258	0	err:
259	0	EVP_PKEY_free(key_obj);
260	0	return ret;
261	0	}
262
263		int TS_CONF_set_signer_digest(CONF conf, const char section,
264		const char md, TS_RESP_CTX ctx)
265	0	{
266	0	int ret = 0;
267	0	const EVP_MD *sign_md = NULL;
268	0	if (md == NULL)
269	0	md = NCONF_get_string(conf, section, ENV_SIGNER_DIGEST);
270	0	if (md == NULL) {
271	0	ts_CONF_lookup_fail(section, ENV_SIGNER_DIGEST);
272	0	goto err;
273	0	}
274	0	sign_md = EVP_get_digestbyname(md);
275	0	if (sign_md == NULL) {
276	0	ts_CONF_invalid(section, ENV_SIGNER_DIGEST);
277	0	goto err;
278	0	}
279	0	if (!TS_RESP_CTX_set_signer_digest(ctx, sign_md))
280	0	goto err;
281
282	0	ret = 1;
283	0	err:
284	0	return ret;
285	0	}
286
287		int TS_CONF_set_def_policy(CONF conf, const char section,
288		const char policy, TS_RESP_CTX ctx)
289	0	{
290	0	int ret = 0;
291	0	ASN1_OBJECT *policy_obj = NULL;
292
293	0	if (policy == NULL)
294	0	policy = NCONF_get_string(conf, section, ENV_DEFAULT_POLICY);
295	0	if (policy == NULL) {
296	0	ts_CONF_lookup_fail(section, ENV_DEFAULT_POLICY);
297	0	goto err;
298	0	}
299	0	if ((policy_obj = OBJ_txt2obj(policy, 0)) == NULL) {
300	0	ts_CONF_invalid(section, ENV_DEFAULT_POLICY);
301	0	goto err;
302	0	}
303	0	if (!TS_RESP_CTX_set_def_policy(ctx, policy_obj))
304	0	goto err;
305
306	0	ret = 1;
307	0	err:
308	0	ASN1_OBJECT_free(policy_obj);
309	0	return ret;
310	0	}
311
312		int TS_CONF_set_policies(CONF conf, const char section, TS_RESP_CTX *ctx)
313	0	{
314	0	int ret = 0;
315	0	int i;
316	0	STACK_OF(CONF_VALUE) *list = NULL;
317	0	char *policies = NCONF_get_string(conf, section, ENV_OTHER_POLICIES);
318
319		/* If no other policy is specified, that's fine. */
320	0	if (policies && (list = X509V3_parse_list(policies)) == NULL) {
321	0	ts_CONF_invalid(section, ENV_OTHER_POLICIES);
322	0	goto err;
323	0	}
324	0	for (i = 0; i < sk_CONF_VALUE_num(list); ++i) {
325	0	CONF_VALUE *val = sk_CONF_VALUE_value(list, i);
326	0	const char *extval = val->value ? val->value : val->name;
327	0	ASN1_OBJECT *objtmp;
328
329	0	if ((objtmp = OBJ_txt2obj(extval, 0)) == NULL) {
330	0	ts_CONF_invalid(section, ENV_OTHER_POLICIES);
331	0	goto err;
332	0	}
333	0	if (!TS_RESP_CTX_add_policy(ctx, objtmp))
334	0	goto err;
335	0	ASN1_OBJECT_free(objtmp);
336	0	}
337
338	0	ret = 1;
339	0	err:
340	0	sk_CONF_VALUE_pop_free(list, X509V3_conf_free);
341	0	return ret;
342	0	}
343
344		int TS_CONF_set_digests(CONF conf, const char section, TS_RESP_CTX *ctx)
345	0	{
346	0	int ret = 0;
347	0	int i;
348	0	STACK_OF(CONF_VALUE) *list = NULL;
349	0	char *digests = NCONF_get_string(conf, section, ENV_DIGESTS);
350
351	0	if (digests == NULL) {
352	0	ts_CONF_lookup_fail(section, ENV_DIGESTS);
353	0	goto err;
354	0	}
355	0	if ((list = X509V3_parse_list(digests)) == NULL) {
356	0	ts_CONF_invalid(section, ENV_DIGESTS);
357	0	goto err;
358	0	}
359	0	if (sk_CONF_VALUE_num(list) == 0) {
360	0	ts_CONF_invalid(section, ENV_DIGESTS);
361	0	goto err;
362	0	}
363	0	for (i = 0; i < sk_CONF_VALUE_num(list); ++i) {
364	0	CONF_VALUE *val = sk_CONF_VALUE_value(list, i);
365	0	const char *extval = val->value ? val->value : val->name;
366	0	const EVP_MD *md;
367
368	0	if ((md = EVP_get_digestbyname(extval)) == NULL) {
369	0	ts_CONF_invalid(section, ENV_DIGESTS);
370	0	goto err;
371	0	}
372	0	if (!TS_RESP_CTX_add_md(ctx, md))
373	0	goto err;
374	0	}
375
376	0	ret = 1;
377	0	err:
378	0	sk_CONF_VALUE_pop_free(list, X509V3_conf_free);
379	0	return ret;
380	0	}
381
382		int TS_CONF_set_accuracy(CONF conf, const char section, TS_RESP_CTX *ctx)
383	0	{
384	0	int ret = 0;
385	0	int i;
386	0	int secs = 0, millis = 0, micros = 0;
387	0	STACK_OF(CONF_VALUE) *list = NULL;
388	0	char *accuracy = NCONF_get_string(conf, section, ENV_ACCURACY);
389
390	0	if (accuracy && (list = X509V3_parse_list(accuracy)) == NULL) {
391	0	ts_CONF_invalid(section, ENV_ACCURACY);
392	0	goto err;
393	0	}
394	0	for (i = 0; i < sk_CONF_VALUE_num(list); ++i) {
395	0	CONF_VALUE *val = sk_CONF_VALUE_value(list, i);
396	0	if (strcmp(val->name, ENV_VALUE_SECS) == 0) {
397	0	if (val->value)
398	0	secs = atoi(val->value);
399	0	} else if (strcmp(val->name, ENV_VALUE_MILLISECS) == 0) {
400	0	if (val->value)
401	0	millis = atoi(val->value);
402	0	} else if (strcmp(val->name, ENV_VALUE_MICROSECS) == 0) {
403	0	if (val->value)
404	0	micros = atoi(val->value);
405	0	} else {
406	0	ts_CONF_invalid(section, ENV_ACCURACY);
407	0	goto err;
408	0	}
409	0	}
410	0	if (!TS_RESP_CTX_set_accuracy(ctx, secs, millis, micros))
411	0	goto err;
412
413	0	ret = 1;
414	0	err:
415	0	sk_CONF_VALUE_pop_free(list, X509V3_conf_free);
416	0	return ret;
417	0	}
418
419		int TS_CONF_set_clock_precision_digits(const CONF conf, const char section,
420		TS_RESP_CTX *ctx)
421	0	{
422	0	int ret = 0;
423	0	long digits = 0;
424
425		/*
426		* If not specified, set the default value to 0, i.e. sec precision
427		*/
428	0	digits = _CONF_get_number(conf, section, ENV_CLOCK_PRECISION_DIGITS);
429	0	if (digits < 0 \|\| digits > TS_MAX_CLOCK_PRECISION_DIGITS) {
430	0	ts_CONF_invalid(section, ENV_CLOCK_PRECISION_DIGITS);
431	0	goto err;
432	0	}
433
434	0	if (!TS_RESP_CTX_set_clock_precision_digits(ctx, digits))
435	0	goto err;
436
437	0	return 1;
438	0	err:
439	0	return ret;
440	0	}
441
442		static int ts_CONF_add_flag(CONF conf, const char section,
443		const char field, int flag, TS_RESP_CTX ctx)
444	0	{
445	0	const char *value = NCONF_get_string(conf, section, field);
446
447	0	if (value) {
448	0	if (strcmp(value, ENV_VALUE_YES) == 0)
449	0	TS_RESP_CTX_add_flags(ctx, flag);
450	0	else if (strcmp(value, ENV_VALUE_NO) != 0) {
451	0	ts_CONF_invalid(section, field);
452	0	return 0;
453	0	}
454	0	}
455
456	0	return 1;
457	0	}
458
459		int TS_CONF_set_ordering(CONF conf, const char section, TS_RESP_CTX *ctx)
460	0	{
461	0	return ts_CONF_add_flag(conf, section, ENV_ORDERING, TS_ORDERING, ctx);
462	0	}
463
464		int TS_CONF_set_tsa_name(CONF conf, const char section, TS_RESP_CTX *ctx)
465	0	{
466	0	return ts_CONF_add_flag(conf, section, ENV_TSA_NAME, TS_TSA_NAME, ctx);
467	0	}
468
469		int TS_CONF_set_ess_cert_id_chain(CONF conf, const char section,
470		TS_RESP_CTX *ctx)
471	0	{
472	0	return ts_CONF_add_flag(conf, section, ENV_ESS_CERT_ID_CHAIN,
473	0	TS_ESS_CERT_ID_CHAIN, ctx);
474	0	}
475
476		int TS_CONF_set_ess_cert_id_digest(CONF conf, const char section,
477		TS_RESP_CTX *ctx)
478	0	{
479	0	int ret = 0;
480	0	const EVP_MD *cert_md = NULL;
481	0	const char *md = NCONF_get_string(conf, section, ENV_ESS_CERT_ID_ALG);
482
483	0	if (md == NULL)
484	0	md = "sha1";
485
486	0	cert_md = EVP_get_digestbyname(md);
487	0	if (cert_md == NULL) {
488	0	ts_CONF_invalid(section, ENV_ESS_CERT_ID_ALG);
489	0	goto err;
490	0	}
491
492	0	if (!TS_RESP_CTX_set_ess_cert_id_digest(ctx, cert_md))
493	0	goto err;
494
495	0	ret = 1;
496	0	err:
497	0	return ret;
498	0	}